Single-Pin Picking

One of the truest forms of lockpicking is single-pin picking or SPP. This is a technique used to open pin tumbler locks, but can
also be used for other types. It not so much a specific method as it is a general approach. The goal is to open the lock while knowing
exactly what is happening inside at all times. By persuing SPP, a picker is striving toward this level of awareness and tries to eliminate
elements of luck during the process. Sometimes SPP is combined with a technique called raking. Raking is basically scrubbing
the pin in different ways to open the lock by a combination of skill and luck. Single-pin picking is generally slower than raking, but is possible
on almost every pin tumbler lock out there. Generally, if the lock is not opening under SPP, it is entirely up to the picker to improve his/her
skills.

How Pin Tumbler Locks Work

Pin Tumbler locks are simple devices consisting of a cylinder called a plug inside a housing
called a shell. The idea is that
the plug should only be able to turn inside the shell if the correct key is inserted. If no key or an incorrected is inserted in the
keyway
(an intricate slot shaped like the key's profile that runs the length of the plug), then elements of the lock will block the plug from turning. A
correct key will interact with the elements in the lock to allow the plug to turn inside the shell. In normal everyday pin tumbler locks, the
elements that block the plug's rotation are called pin stacks. They consist of a series (usually 4, 5, or 6) of holes called
chambers drilled through the shell and into the plug. Inside each of these chambers is two cylindrical pins stacked on top of each
other and under pressure from a spring (which is in the shell).

The key lifts these pin stacks so that the separation between the two pins in each chamber meets the edge of the plug and shell hole
(where the plug resides). This split in the chamber is called the shear line. If a pin stack is not lifted high enough, then the
driver pin/top pin (pin furthest from the keyway and touching the spring) will be half inside the shell's chamber and half-inside the
plug's chamber. If a pin stack is lifted too far, then the key pin/bottom pin will be at this intersection. Both of the situations cause
the plug to be blocked from turning. Only when all of the pin stacks are lifted perfectly so that the split between the drivers and key pins are
right on the shear line will the plug turn and the lock open. Each of the valleys or cuts in the key correctly lifts a pin stack in its
lock. You can quickly determine how many pins a lock has by counting its key's cuts.

The Problem: Tolerances

I will now explain why locks are not perfect and the biggest vulnerability that can be used to open them without the key. Lets imagine a
typical 5 pin house lock with no extra security features. If there is no key inserted, all of the pin stacks are pressed down (toward the keyway)
fully by their springs. If you insert a screwdriver and try to turn the plug, the 5 drivers will all block this from happening. Now if you insert a
blank key (a full key that fits with no cuts in it), all of the pin stacks will be lifted as high as possible. If you try the screwdriver again now (or the
blank itself), unless the lock happens to be pinned for a blank, all 5 key pins will block plug rotation. If locks were perfect, picking would not be
possible. Every pin stack would block plug rotation equally and the plug could only turn if all of the pins are lifted simultaneously (i.e: with a key).

However, locks are not perfect and tolerance errors make the reality of lock operation slightly different than their design. Tolerance errors are
an inescapable fact of manufacturing and it basically means that machining operations can never be perfectly peformed. These issues are
also created or made worse by normal use. The longer a lock is in use or being picked, the sloppier the tolerances will get. Here are some of the
issues that make picking possible: Chambers not all same diameter, chambers out of alignment, chambers drilled at different angles, plug has
slight taper or twist, shell has slight taper or twist, pins different diameter, etc... All of these discrepancies are very small and are likely not
noticable by the human eye, but they make a mechanical difference. They create a situation where only one pin stack is actually blocking
plug rotation at a time. Sidenote: In reality, the elasticity of the metal may cause 2 pins to block at a time. The pin that is blocking rotation at
a particular time is referred to as the binding pin.

Overview of Picking

So how can we exploit these tolerance errors to open a lock? We can set pins one at a time instead of all at once. Setting a pin is
the act of lifting a pin stack to the shear line (correct height) in a way that causes it to stay there. Once a pin is set, we can move on the next.
When we set all of the pins in the lock, it will open. The way to make the pins stay set after correct lifting is to apply tension. Tension
is the lockpicking term for putting rotational pressure on the plug. The basic technique is to apply tension with a tool called a
tension wrench and then use a lock pick to lift each pin one at a time until they set. The trick is to understand that
you can only set the
pin(s) that is binding at that time. You can't just choose any pin and lift it under tension to make it *click* (the sensation of a pin setting). Once
you set a pin, another will bind (block plug rotation). Continue this process until the lock is open. The sequence in which the pins bind (and
hence must be set) is called the binding order and is unique to each lock. For SPP, we are likely going to use some form of
hook pick.

Tension

Tension is the turning force which must be applied to the plug in order to make pins set. There are quite a few types of tension tools used in
lockpicking, but the standard tension wrench is a strip of steel roughly 1/8th inch wide and 3-4 inches long with a 90 degree bend in it. A
common variant has a twist in the handle for comfort. One of the most useful modifications is to add serrations on the working end which allows
the tool is grip the keyway and prevents slipping. These types of tensioners are designed to fit the bottom of the keyway with the handle
pointing off to the side. Resting a finger on the the handle provides the tension needed to pick. There is another popular type of wrench called
flat tensioner which is designed to be used in the top of the keyway with the handle pointing up.
In many cases, using flat tensioners
frees up more space in the keyway for the pick to move around. Using a tensioner that fits the keyway nicely and snuggly can greatly help
during picking.

There has been much written about the correct amount of tension to use. One thing is clear: controlling the amount of tension you are
applying is very important in picking. A common idea is that you should use the lightest tension possible while still being able to set pins.
Also, different lock will require different amounts of tension. When I start picking a lock, I like to find a binding pin by applying heavy tension.
I then try to lift it while slowly letting off tension until I am able to lift the binding pin in a controlled manner. Some folks do the opposite and
start with no tension and gradually increase it until they detect a binding pin. If every pin in the lock is springy and just comes right back down
after being lifted, you are applying too little tension. If the binding pin is impossible to lift (its stuck), you are applying too much tension. Most
people (especially beginners) have a tendency to go too heavy on the tension.

Lifting Pins

Next we'll talk about the act of individually lifting pins up in order to "set" them. Getting comfortable holding the pick is the first step
in being able to feel your way around the inside of a lock. The most common "proper" way to do this is like a pencil with your index (or middle
in my case) finger resting on the top of the pick's shaft. When you first start picking for long periods of time, the pad of this finger will get
sore and may even bleed, but over time you'll develop a little callus there. After you've found a grip that is comfortable, its time to get a
feel for the pins. Starting from the back of the lock and pulling outward while keeping a loose grip on the pick will allow its tip to ride over the
pin tips. Try counting them without lifting anything; then try moving from pin to pin while keeping track of which one you're on. By practicing
this sort of thing enough, you'll eventually be able to just choose a pin and know exactly how far into the lock it is. These depth perception
and counting pin exercises alone will help a lot to cure what I call keyway chaos. When faced with a new type of lock, every beginner
and many advanced lockpickers experience this phenomenon (the feeling of having no idea what is going on inside the lock). If you have
tried these exercises for a while and are still experiencing this keyway chaos, try removing a few of the pin stacks and then add them back in
later.

Once you have a good feel for where the pins are and what they feel like on the end of a pick, its time to try lifting some up. There are two
popular ways to do this: levering and straight-lifting. Straight-lifting is what most newbies try first, but I find it is not the best for most situations.
To straight-lift, simply position the pick tip under the center of the tip of the pin you wish to lift; then lift the pick up while keeping it horizontal.
Levering involves positioning the pick tip under the target pin as well, but the method of lifting it up is different; you choose a point under the
shaft of the pick and use it as a fulcrum to lever the pick tip up. This pivot point does not necessarily have to be a physical one and can exist
anywhere as long as you lever the pick in that manner. Keyway warding can present a challenge while lifting pins (especially in very paracentric
keyways). You can either try to snake the pick through the warding as you lift, or you can try to lever it off a ward. In the nastiest keyways, it is
sometimes necessary to lever off one ward, keep the pin binding, remove the pick, and reinsert it higher in the keyway to continue the lift. These
details that I've given here are merely my own experiences; in the end, if it feels comfortable and you're setting pins, you're doing it right :-)

Pin States

Now that we know the basic steps involved in picking, you may be asking yourself: How do I find a binding pin? This is a very important skill
in picking and will likely take more practice than anything else (except perhaps tension control). While picking, you should be moving from
pin to pin one at a time identfiying what the state of that pin stack is. This builds a mental picture of the lock. Pins that feel springy when
pressed up (under tension of course), are unset pins and also are not binding. These should be ignored for the time being, but
not forgotten about. You now know that those pins will have to be dealt with later. Other pins will feel completely loose (no resistance which
is hard to feel for) and non-springy up to a certain lift height. Once you try to press it higher than that, it will feel like it has hit a wall.
These are indications of a set pin, but be careful; it might be a false set. We will discuss false sets and the security pins
that produce them later. Your goal is to bring every pin in the lock to this set state. The state we are searching for is binding.
You can recognize this state because when you lift a binding pin, you will feel resistance/stickiness. This is the friction of the shear line
pressing on the top pin as it being pressed up. The resistance you feel will be proportional to the amount of tension applied. This same
feeling will also happen if you have gone too far and overlifted a pin. However, if you are careful and stop lifting a binding pin when
it *clicks*, the pin will no be overset.

Security Driver Pins

There are a lot of ways that lock manufacturers can make their cylinders harder to pick. By far, the most common are security pins.
These are typically replacement pins that are substituted in for some of the driver pins that are designed to make picking and other attacks more
difficult. Different types will impact picking difficulty to various degrees. Some security pins, like the shallow spools in Master locks, will only
require a little paying attention to defeat. Others, like the nasty spools found in the Assa Twin 6000, will make picking seem impossible.

The
most common type of security pin is called a Spool and is shaped like an empty spool of thread.
When this pin is binding and being lifted, it will behave normally until the middle section reaches the shear line (unless it begins that way). At
that point it will cause a false set which means that the plug will be allowed to rotate slightly and a "click" will be felt. If very light
tension is used this false set can be skipped over, but that is quite difficult. I prefer to allow these false sets to happen and then identify them.
You can recognize a false set on a spool pin by continuing to lift the pin up. If the plug begins to counter-rotate (turn in the direction
opposite the applied tension) before clicking again (and making the plug rotate back over in the correct direction), you can be resonably sure
that the pin was a falsely set spool but is now properly set. On the other hand, if further lifting only produces counter-rotation but no extra
"click", the pin was not a spool and you can release some tension to correct the overset you caused by testing it. Now the next time you set
that pin, you can be sure its a real set.

Another type of security pin is the Serrated pin which has multiple "rings" that can cause false
sets. These can be handled in the same way as spools, but are typically much more difficult and a certain amount of guess-work and instinct
is useful in distinguishing false from real sets. A more rare type of security pin that Medeco loves to use is a Mushroom pin.
These are shaped like their name implies with the big "cap" end toward the keyway. The effect of lifting these pins under
tension is that they will rock over/turn slightly-sideways in the pin chamber. This action combined with the shape of the cap causes the plug
plug rotation and false set to sort of "lock" in place. Typically, you can handle these the same way as spools in most cases, but some can stop the best pickers in their tracks. If you encounter a security pin that is completely "stuck" in a
false set, there is always a last resort. You can physically rotate the plug in the direction opposite tension a small bit while lifting until the pin
slips out of the false set.

Practicing

Getting better at SPP is a process that takes time and lots of trying. More important than time is focus. By this, I mean that when you are
picking it should not be a passive thing. Your attention should be focused on the lock and constantly analyzing. You should be asking yourself
about the state of the current pin, how many pins are set, which ones feel like security pins, what types of security pins, etc... Try picking in an
order different than the first apparent binding order and see what happens. A very effective method of learning is what most of us call
the digital_blue method. This is a practice method made popular by the admin of
Lockpicking101.com that involves picking partially-pinned locks and working up. My favorite way
to do this is to remove all of the pins but 1 or 2 and then pick those, scramble them up, and pick them again. Once you feel that any 2 pin
combination is "easy", add a third pin and repeat the process. Eventually you will be able to pick the fully-pinned version by following this method.
If you are having trouble at the 5-pin mark, try going back to 4 for a bit. You can also try putting the 5 in a different subset of pin chambers; this
may help you discover that the tool you are using cannot reach the last chamber without upsetting a pin in the middle, for example.